AZ-900
Deep Dive
The single most important principle for understanding cloud security. It defines exactly who's responsible for what at each layer of the technology stack — and it changes depending on the service model.
Contents
In the cloud, security and management aren't the exclusive responsibility of any single party. Microsoft and you share responsibilities — the distribution depends on the service model you use.
This model exists because in a physical datacenter, you control absolutely everything. When you move workloads to the cloud, you hand off certain control to the provider in exchange for them managing those layers. The model defines exactly where the line is.
Why this concept exists (and why it matters)
In 2021, 48% of cloud security breaches were caused by customer misconfiguration — not Microsoft vulnerabilities. In every one of those cases, the customer wrongly assumed "Microsoft handles everything".
Understanding this model is the difference between a secure architecture and an average $4M data breach.
Every layer of the technology stack, and who's responsible for it depending on the service model.
| Stack layer | On-Premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Physical facilities | Customer | Microsoft | Microsoft | Microsoft |
| Hardware (servers, storage, switches) | Customer | Microsoft | Microsoft | Microsoft |
| Physical network | Customer | Microsoft | Microsoft | Microsoft |
| Hypervisor / Virtualization | Customer | Microsoft | Microsoft | Microsoft |
| Operating System | Customer | Customer | Microsoft | Microsoft |
| Middleware / Runtime | Customer | Customer | Microsoft | Microsoft |
| Application | Customer | Customer | Customer | Microsoft |
| Application data | Customer | Customer | Customer | Shared |
| Endpoints (user devices) | Customer | Customer | Customer | Customer |
| Identity and access (IAM) | Customer | Customer | Shared | Shared |
| Network and firewall (config) | Customer | Shared | Shared | Microsoft |
No matter the service model (IaaS, PaaS, or SaaS), these responsibilities never change.
Microsoft is ALWAYS responsible for:
You're ALWAYS responsible for:
In IaaS (Azure Virtual Machines), you control everything from the OS up. That means more power and more responsibility.
Example: Azure Virtual Machine with Windows Server 2022
Microsoft manages:
You manage:
Real-world IaaS breach scenario
Company X has 200 VMs in Azure IaaS. The sysadmin doesn't apply the April Windows patch (critical CVE). An attacker exploits the vulnerability, gains access to 50 VMs, exfiltrates customer data.
Who's responsible? The customer. Microsoft delivered a functioning OS. The customer was responsible for patching it and didn't. Microsoft does NOT have access to the VM to patch it without your consent.
In PaaS (Azure App Service, Azure SQL Database), Microsoft manages the OS and runtime. You only worry about your code and data.
Example: Azure App Service (Web App)
Microsoft manages:
You manage:
"Shared" responsibility in PaaS: IAM and Network
Network and firewall
Microsoft handles the physical network. You configure the rules: which IPs can access (restrictions), VNet integration, Private Endpoints. If you leave public access open by mistake, it's your responsibility.
Identity and access
Microsoft provides Entra ID. You decide who has which roles in your App Service. A developer with an Owner role they shouldn't have = your mistake, not Microsoft's.
In SaaS (Microsoft 365, Teams, SharePoint Online), Microsoft manages almost everything. But your responsibilities remain critical.
Example: Microsoft 365 (Exchange Online + SharePoint)
Microsoft manages:
You're still responsible for:
Common critical mistake in SaaS
A company assumes "Microsoft backs up Teams/SharePoint" and doesn't implement Veeam or similar. An employee accidentally deletes 3 years of SharePoint documents. Microsoft only guarantees restoration up to 93 days in SharePoint (and deleted Teams chat may be unrecoverable).
Lesson: In SaaS, you're still responsible for the business continuity of YOUR data. Microsoft protects its platform, not your specific data.
The most common — and costly — mistakes happen when customers assume Microsoft covers something that's actually the customer's responsibility.
Storage account with public access enabled
Azure Storage lets you enable "Allow public access" at the account level. If you turn this on + don't have logging, you expose data publicly. Microsoft doesn't prevent it — it's a legitimate option. You're responsible for the configuration.
Capital One (2019): $80M fine + 140M accounts leaked due to S3 misconfiguration.
Admin passwords without MFA
Microsoft Entra ID can require MFA — if you configure it. If you create admin accounts without MFA and a weak password, Entra ID correctly authenticates the attacker. Microsoft authenticated correctly; you didn't turn on MFA.
99.9% of compromised-account attacks are prevented by MFA (Microsoft Security Report 2023).
VM with RDP exposed to the internet (port 3389)
NSGs allow everything by default if you don't configure them. A VM with RDP/SSH open to the world is a direct brute-force target. Microsoft delivered the VM. You configured (or failed to configure) the NSG.
Microsoft blocks 300M+ fraudulent authentication attempts daily — many against VMs with open ports.
Excessive permissions (least privilege violation)
A developer with a "Contributor" role can accidentally delete an entire resource group in production. Azure RBAC allows Contributor. You decide who has which role. Microsoft doesn't know whether that developer should have that permission or not.
Human error is the #1 cause of cloud incidents (Gartner 2024).
When you use Azure, you can inherit Microsoft's certifications — but only for the layers Microsoft manages. Your layer still needs compliance.
Azure certifications (that you can inherit)
What you still have to do for compliance
Azure gives you the tools; you have to use them correctly.
Did you get this topic?
Test what you just learned
In the IaaS model, what is the customer responsible for that the cloud provider is not?
Put what you learned to the test with original AZ-900 exam questions.
Start AZ-900 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.